[PATCH net] net: lan743x: fix RX checksum use-after-free

[PATCH net] net: lan743x: fix RX checksum use-after-free

[Mark Amirkan via B4 Relay]

From: Mark Amirkan <markdamirkan@gmail.com>

lan743x_rx_process_buffer() adds each non-first receive buffer to the
head skb's frag_list.  On the last descriptor, lan743x_rx_trim_skb()
linearizes the head and frees the fragment skb metadata.

The checksum-success path then writes ip_summed through the local skb
pointer, which still points to the final fragment.  This causes a
use-after-free write when a packet spans more than one receive buffer.

Set ip_summed on the surviving head skb instead.  Multi-buffer receive
can occur after a live MTU increase because existing ring entries keep
their old buffer size until they are replenished.

A KUnit test invoking lan743x_rx_process_buffer() with a two-buffer
packet produced a one-byte KASAN use-after-free write before this change.
The same test passed after the change.  The driver object also builds
with W=1.  This was not tested on physical LAN743x hardware.

Fixes: cd6910501cfd ("net: lan743x: Add support for Rx IP & TCP checksum offload")
Cc: stable@vger.kernel.org
Assisted-by: LLM Symbolic
Signed-off-by: Mark Amirkan <markdamirkan@gmail.com>
---
 drivers/net/ethernet/microchip/lan743x_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
index 24ae56a3c9ed7..82d3ec20ba259 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.c
+++ b/drivers/net/ethernet/microchip/lan743x_main.c
@@ -2604,7 +2604,7 @@ static int lan743x_rx_process_buffer(struct lan743x_rx *rx)
 							rx->adapter->netdev);
 		if (rx->adapter->netdev->features & NETIF_F_RXCSUM) {
 			if (!is_ice && !is_tce && !is_icsm)
-				skb->ip_summed = CHECKSUM_UNNECESSARY;
+				rx->skb_head->ip_summed = CHECKSUM_UNNECESSARY;
 		}
 		netdev_dbg(netdev, "sending %d byte frame to OS",
 			   rx->skb_head->len);

---
base-commit: e6b6078ea1731b05b3b552497b3bce4bf8b014ae
change-id: 20260913-b4-send-lan743x-uaf-9d770ad5c929

Best regards,
--  
Mark Amirkan <markdamirkan@gmail.com>

Re: [PATCH net] net: lan743x: fix RX checksum use-after-free

[Chenguang Zhao]

On Sun, Sep 13, 2026 at 05:14:09PM -0700, Mark Amirkan wrote:
> lan743x_rx_process_buffer() adds each non-first receive buffer to the
> head skb's frag_list.  On the last descriptor, lan743x_rx_trim_skb()
> linearizes the head and frees the fragment skb metadata.
> 
> The checksum-success path then writes ip_summed through the local skb
> pointer, which still points to the final fragment.  This causes a
> use-after-free write when a packet spans more than one receive buffer.
> 
> Set ip_summed on the surviving head skb instead.  Multi-buffer receive
> can occur after a live MTU increase because existing ring entries keep
> their old buffer size until they are replenished.
> 
> A KUnit test invoking lan743x_rx_process_buffer() with a two-buffer
> packet produced a one-byte KASAN use-after-free write before this change.
> The same test passed after the change.  The driver object also builds
> with W=1.  This was not tested on physical LAN743x hardware.
> 
> Fixes: cd6910501cfd ("net: lan743x: Add support for Rx IP & TCP checksum offload")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM Symbolic
> Signed-off-by: Mark Amirkan <markdamirkan@gmail.com>
> ---
>  drivers/net/ethernet/microchip/lan743x_main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
> index 24ae56a3c9ed7..82d3ec20ba259 100644
> --- a/drivers/net/ethernet/microchip/lan743x_main.c
> +++ b/drivers/net/ethernet/microchip/lan743x_main.c
> @@ -2604,7 +2604,7 @@ static int lan743x_rx_process_buffer(struct lan743x_rx *rx)
>  							rx->adapter->netdev);
>  		if (rx->adapter->netdev->features & NETIF_F_RXCSUM) {
>  			if (!is_ice && !is_tce && !is_icsm)
> -				skb->ip_summed = CHECKSUM_UNNECESSARY;
> +				rx->skb_head->ip_summed = CHECKSUM_UNNECESSARY;
>  		}
>  		netdev_dbg(netdev, "sending %d byte frame to OS",
>  			   rx->skb_head->len);
> 
> ---
> base-commit: e6b6078ea1731b05b3b552497b3bce4bf8b014ae
> change-id: 20260913-b4-send-lan743x-uaf-9d770ad5c929
> 
> Best regards,
> --  
> Mark Amirkan <markdamirkan@gmail.com>
> 
Reviewed-by: Chenguang Zhao <zhaochenguang@kylinos.cn>

Chenguang
Thanks